Under the right of access to documents in the EU treaties, as developed in Regulation 1049/2001, I am requesting documents which contain the following information:

- All documents concerning the selection-process of the 'Independent Experts and Observers of the Pilot Project (PP) and the Preparatory Action on Defence Research (PADR)';
- All documents containing biographical data and curricula vitae of these experts.

Thank you for your request for access to documents. We hereby acknowledge receipt, and will revert to you within 15 working days from the date of reception of your email. Please be aware that our offices are closed from Monday 24 December till Thursday 3 January 2019.
Please note that all requests for access to documents must be sent to [EDA request email].
Best regards,

We refer to your e-mail dated 19/12/2018 in which you make a request for access to documents.

You request access to:

“- All documents concerning the selection-process of the 'Independent Experts and Observers of the Pilot Project (PP) and the Preparatory Action on Defence Research (PADR)';
- All documents containing biographical data and curricula vitae of these experts.”

Your application concerns the following documents:

1.Call for experts to assist the European Defence Agency (EDA) with tasks in connection with the Preparatory Action on Defence Research 2017-2019 (https://www.eda.europa.eu/docs/default-s...)
2.Letter from EDA to the European Commission, ref. EDA201606089/ESI/ICE;
3.Letter from the European Commission to EDA, ref. ARES(2016)3862881;
4.Letter from the European Commission to EDA, ref. ARES(2016)3152477;
5.Letter from EDA to the European Commission, ref. EDA201605011/ESI/ICE;
6.EDA note, ref. EDA201601020;
7.EDA note, ref.201709168/DT/DD;
8.Privacy Statement.

Pursuant to Article 4(1)(b) of Regulation (EC) No 1049/2001, access to a document has to be refused if its disclosure would undermine the protection of privacy and the integrity of the individual, in particular in accordance with European Union legislation regarding the protection of personal data.

The applicable legislation in this field is Regulation (EC) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘Regulation 2018/1725’). (Official Journal L 205 of 21.11.2018, p. 39.)

The documents to which you request access contains/contain personal data, in particular, name, surname, phone numbers and handwritten signatures.

Indeed, Article 3(1) of Regulation 2018/1725 provides that personal data ‘means any information relating to an identified or identifiable natural person […]’. The Court of Justice has specified that any information, which by reason of its content, purpose or effect, is linked to a particular person is to be considered as personal data. (Judgment of the Court of Justice of the European Union of 20 December 2017 in Case C-434/16, Peter Nowak v Data Protection Commissioner, request for a preliminary ruling, paragraphs 33-35, ECLI:EU:C:2017:994.)

In its judgment in Case C-28/08 P (Bavarian Lager - Judgment of 29 June 2010 in Case C 28/08 P, European Commission v The Bavarian Lager Co. Ltd, EU:C:2010:378, paragraph 59), the Court of Justice ruled that when a request is made for access to documents containing personal data, the Data Protection Regulation becomes fully applicable (whereas this judgment is specifically related to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, the principles set out therein are also applicable under the new data protection regime established by Regulation 2018/1725.)

Pursuant to Article 9(1)(b) of Regulation 2018/1725, ‘personal data shall only be transmitted to recipients established in the Union other than Union institutions and bodies if ‘[t]he recipient establishes that it is necessary to have the data transmitted for a specific purpose in the public interest and the controller, where there is any reason to assume that the data subject’s legitimate interests might be prejudiced, establishes that it is proportionate to transmit the personal data for that specific purpose after having demonstrably weighed the various competing interests’.

Only if these conditions are fulfilled and the processing constitutes lawful processing in accordance with the requirements of Article 5 of Regulation 2018/1725, can the transmission of personal data occur.

According to Article 9(1)(b) of Regulation 2018/1725, the European Defence Agency has to examine the further conditions for a lawful processing of personal data only if the first condition is fulfilled, namely if the recipient has established that it is necessary to have the data transmitted for a specific purpose in the public interest. It is only in this case that the European Defence Agency has to examine whether there is a reason to assume that the data subject’s legitimate interests might be prejudiced and, in the affirmative, establish the proportionality of the transmission of the personal data for that specific purpose after having demonstrably weighed the various competing interests.

In your request, you do not put forward any arguments to establish the necessity to have the data transmitted for a specific purpose in the public interest. Therefore, the European Defence Agency does not have to examine whether there is a reason to assume that the data subject’s legitimate interests might be prejudiced.

Consequently, I conclude that, pursuant to Article 4(1)(b) of Regulation 1049/2001, access cannot be granted to the personal data, as the need to obtain access thereto for a purpose in the public interest has not been substantiated and there is no reason to think that the legitimate interests of the individuals concerned would not be prejudiced by disclosure of the personal data concerned.

Additionally, in accordance with article 4(1)(a) fourth indent, “the institutions shall refuse access to a document where disclosure would undermine the protection of the financial, monetary or economic policy of the Community or a Member State”.

As you might know already, the names of the EDA experts are already in the public domain (https://www.eda.europa.eu/docs/default-s...).
Their names, however, are not published per call. This is due to the fact that in some areas only a limited number of experts is available and therefore, if members of the public know with exactness in which call(s) experts are involved, they might become a subject to influence and pressure from the outside world. This in turn would undermine their independence which will have a negative impact on the financial interests of the Union. For these reasons, safeguarding the independence of the experts is of utmost importance. Hence, in order to protect the interests under Article 4(1)(a) fourth indent, the call references have been redacted.

Please be informed that the interests under Article 4(1) are absolute in nature and therefore not balanced by an overriding public interest in disclosure.

Please further note that two of the documents falling under the scope of your request originate from a third party. In accordance with Article 4(4) of Regulation 1049/2001, “as regards third-party documents, the institution shall consult the third party with a view to assessing whether an exception in paragraph 1 or 2 is applicable, unless it is clear that the document shall or shall not be disclosed.”

We are currently expecting the response of the third party and will provide you with a response with regard to these two documents by 25 January 2019 COB.

Means of redress

In accordance with Article 7(2) of Regulation 1049/2001, you are entitled to make a confirmatory application requesting EDA to review its position.

Such a confirmatory application should be addressed within 15 working days upon receipt of this letter to the Chief Executive of EDA to the following email: [EDA request email].

Please pass this on to the person who reviews confirmatory applications.

I am filing the following confirmatory application with regards to my access to documents request 'Experts PADR'.

In your letter on 22/01 you state that "the documents to which you request access contains/contain personal data, in particular, name, surname, phone numbers and handwritten signatures." You also stated that publishing the relevant documents would undermine article 4(1)(a) fourth indent.

However, in your letter you have not taken into account article 4(6) stating that "if only parts of the requested document are covered by any of the exceptions, the remaining parts of the document shall be released".

While acknowledging the sensitive nature of the requested documents, parts of the documents should be open for disclosure, especially the employers of these experts in question. I would like to point out that the European Commission has the good practice of making the list of consulted experts including their employers available to the public: https://ec.europa.eu/info/funding-tender...

There is an overriding interest in disclosing these documents. Experts might represent the interests of their private employers. As such it is important for the general public to be able to hold the EDA accountable in the case of any potential conflict of interests.

While we do not ask for any sensitive personal information such as telephone numbers or handwritten signatures, the EDA should reconsider its position regarding other biographical information, which may play a role in the activities these experts carry out . As you pointed out in your letter, the names of these experts are already publicly available to the general public. The names of these experts are however not enough as there is no way of knowing whose interests these experts represent.

Furthermore, you stated in your letter that you were "expecting the response of the third party and will provide you with a response with regard to these two documents by 25 January 2019 COB". Until now, you have not provided us with a response with regard to these documents.

Dear Mr Vranken,
We hereby acknowledge receipt of your confirmatory application with regards to your access to documents request 'Experts PADR' of 19 December 2018. We will come back to you within 15 working days.
Kind regards,
EDA

We refer to your e-mail dated 19/12/2018 in which you submitted a request for access to documents.

We further refer to our reply of 22/01/2019, wherein we have provided you with a partial response to your request and informed you that two of the documents falling under the scope of your request originate from a third party and hence, a consultation of the third party was necessary.

We apologise for the slight delay in replying.

We are pleased to inform you that the third party agreed to grant access to the two documents in question, namely:

1.Letter from the European Commission to EDA, ref. ARES(2016)3862881;
2.Letter from the European Commission to EDA, ref. ARES(2016)3152477;

Pursuant to Article 4(1)(b) of Regulation (EC) No 1049/2001, access to a document has to be refused if its disclosure would undermine the protection of privacy and the integrity of the individual, in particular in accordance with European Union legislation regarding the protection of personal data.

The applicable legislation in this field is Regulation (EC) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (1) (‘Regulation 2018/1725’).

The documents to which you request access contain personal data, in particular, name, surname, phone numbers and handwritten signatures.
Indeed, Article 3(1) of Regulation 2018/1725 provides that personal data ‘means any information relating to an identified or identifiable natural person […]’. The Court of Justice has specified that any information, which by reason of its content, purpose or effect, is linked to a particular person is to be considered as personal data. (2)

In its judgment in Case C-28/08 P (Bavarian Lager) (3), the Court of Justice ruled that when a request is made for access to documents containing personal data, the Data Protection Regulation becomes fully applicable (4).

Pursuant to Article 9(1)(b) of Regulation 2018/1725, ‘personal data shall only be transmitted to recipients established in the Union other than Union institutions and bodies if ‘[t]he recipient establishes that it is necessary to have the data transmitted for a specific purpose in the public interest and the controller, where there is any reason to assume that the data subject’s legitimate interests might be prejudiced, establishes that it is proportionate to transmit the personal data for that specific purpose after having demonstrably weighed the various competing interests’.

Only if these conditions are fulfilled and the processing constitutes lawful processing in accordance with the requirements of Article 5 of Regulation 2018/1725, can the transmission of personal data occur.

According to Article 9(1)(b) of Regulation 2018/1725, the European Defence Agency has to examine the further conditions for a lawful processing of personal data only if the first condition is fulfilled, namely if the recipient has established that it is necessary to have the data transmitted for a specific purpose in the public interest. It is only in this case that the European Defence Agency has to examine whether there is a reason to assume that the data subject’s legitimate interests might be prejudiced and, in the affirmative, establish the proportionality of the transmission of the personal data for that specific purpose after having demonstrably weighed the various competing interests.

In your request, you do not put forward any arguments to establish the necessity to have the data transmitted for a specific purpose in the public interest. Therefore, the European Defence Agency does not have to examine whether there is a reason to assume that the data subject’s legitimate interests might be prejudiced.

Consequently, we conclude that, pursuant to Article 4(1)(b) of Regulation 1049/2001, access cannot be granted to the personal data, as the need to obtain access thereto for a purpose in the public interest has not been substantiated and there is no reason to think that the legitimate interests of the individuals concerned would not be prejudiced by disclosure of the personal data concerned.

Means of redress
In accordance with Article 7(2) of Regulation 1049/2001, you are entitled to make a confirmatory application requesting EDA to review its position.
Such a confirmatory application should be addressed within 15 working days upon receipt of this letter to the Chief Executive of EDA to the following email: [EDA request email].

Yours faithfully,
EDA

-----------------------
(1) Official Journal L 205 of 21.11.2018, p. 39.
(2) Judgment of the Court of Justice of the European Union of 20 December 2017 in Case C-434/16, Peter Nowak v Data Protection Commissioner, request for a preliminary ruling, paragraphs 33-35, ECLI:EU:C:2017:994.
(3) Judgment of 29 June 2010 in Case C 28/08 P, European Commission v The Bavarian Lager Co. Ltd, EU:C:2010:378, paragraph 59.
(4) Whereas this judgment specifically related to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, the principles set out therein are also applicable under the new data protection regime established by Regulation 2018/1725.

Many thanks for your response. We welcome the decision of the EDA to disclose the affiliation of the experts. In the documents I have received however, some of the affiliations are still blacked out. Is it possible that there was a mistake in blacking out the affiliations?

We refer to your email of 27 February 2019 wherein you requested some
additional clarifications concerning EDA's response to your confirmatory
application.

Please be informed that the files disclosed to you contain also the
personal data of the non-selected experts and these data have been
expunged. In accordance with your request, only personal data of selected
experts were released.

As regards one of the experts, namely Mr Prieur - please note that
affiliation was not included as the expert in question was self-employed
at that time.

We hope that the information above provides sufficient clarifications.